I already provided a theory. It is just a theory because I can't poke around in your server or look at the messages in question.
Ed Crowley MCSE+Internet MVP Freelance E-Mail Philosopher Protecting the world from PSTs and Bricked Backups!T -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jean-Paul Natola Sent: Friday, November 05, 2004 12:23 PM To: Exchange Discussions Subject: RE: Virus or Spam please advise Any suggestions, thoughts ideas ? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ed Crowley [MVP] Sent: Friday, November 05, 2004 2:42 PM To: Exchange Discussions Subject: RE: Virus or Spam please advise It's highly unlikely that the X.400 address would have any relationship to your problem. Ed Crowley MCSE+Internet MVP Freelance E-Mail Philosopher Protecting the world from PSTs and Bricked Backups!T -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jean-Paul Natola Sent: Friday, November 05, 2004 6:42 AM To: Exchange Discussions Subject: RE: Virus or Spam please advise Ok I just checked, and yes although I did not create it, it does have an x400 address, its probably one those that were created prior to me discovering the "update email address based on recipient policy" I now deleted the x400 address, so in theory I should never get one like that again ( pertaining to her or any other contacts that do NOT have [EMAIL PROTECTED] ) -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ed Crowley [MVP] Sent: Friday, November 05, 2004 2:44 AM To: Exchange Discussions Subject: RE: Virus or Spam please advise The contact has an address in your domain as well, right? Is it one that might be randomly or methodically selected as a target address for spam? If so, a spam message might have been directed to it that got redirected to its target address, which bounced because of the typo. Seem plausible? Ed Crowley MCSE+Internet MVP Freelance E-Mail Philosopher Protecting the world from PSTs and Bricked Backups!T -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jean-Paul Natola Sent: Thursday, November 04, 2004 8:15 PM To: Exchange Discussions Subject: Virus or Spam please advise Hi everyone, I'm tryuing to determine what is going on here, I created today a few contacts and distribution lists. On one I did a typo , but my CONCERN is that no-one is aware of the lists I created ,therefore no-one could have sent/attempted to send this , yet I got this in my inbox tonight; are one of my nodes infected? Is the SERVER infected, or is this just some for of spam? Message from yahoo.fr. Unable to deliver message to the following address(es). <[EMAIL PROTECTED]>: This user doesn't have a yahoo.fr account ([EMAIL PROTECTED]) [0] --- Original message follows. X-Originating-IP: [68.167.21.154] Return-Path: <[EMAIL PROTECTED]> Received: from 68.167.21.154 (EHLO fci-ex.FCI) (68.167.21.154) by mta123.mail.re2.yahoo.com with SMTP; Thu, 04 Nov 2004 16:05:13 -0800 Received: from mail pickup service by fci-ex.FCI with Microsoft SMTPSVC; Thu, 4 Nov 2004 19:05:13 -0500 thread-index: AcTCyx98ytXKd5uvTqG2daAf4kUQLA== Thread-Topic: Symantec Mail Security detected an unrepairable virus in a message you sent (SYM:41393752640856770229) From: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Subject: Symantec Mail Security detected an unrepairable virus in a message you sent (SYM:41393752640856770229) Date: Thu, 4 Nov 2004 19:05:13 -0500 Message-ID: <[EMAIL PROTECTED]> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft CDO for Exchange 2000 Content-Class: urn:content-classes:message Importance: normal Priority: normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.181 X-OriginalArrivalTime: 05 Nov 2004 00:05:13.0765 (UTC) FILETIME=[1F9B7D50:01C4C2CB] Subject of the message: Re: Thanks :) Recipient of the message: "Lbert" <[EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
